Tracing NFS activity


The problem

You need to benchmark a pre-production new NFS server. "Standard" benchmarks (bonnie, iozone, plain old dd) are not enough, since they generate a workload different from the "real" one you expect to have in a full production environment. So you need to stress test the new server with a workload as similar as possible to the "real" one. You need to measure precisely what your workload is.

Partial solution

Collect data

tcpdump -c 1000000 -i bond0 -p -s 256 -w /local_scratch/pcap/bond0.pcap -C 16 host and udp and 'ip[6:2] & 0x1fff = 0' and not multicast and not broadcast

Analyze data

tcpdump -n -r bond0.pcap8 -vvv

or if you are interested only in workload (and not its originating client): tcpdump -n -r bond0.pcap8 -vvv | egrep -o '[^ ]+ fh [^ ]+ .+'

This ugly piece of code will split the NFS filehandle into the slightly more meaningful format inode/generation/pad:
(see also this NFS File Handle Security for a more complete decode of the FH)


Next one needs to